CISA and other Political gambits

Last week, the Office of Personnel Management revealed it had been hacked. The White House and FBI are wanting backdoors in encryption. The world of politics not only wants us to be spied upon, but less secure and then complains about being hacked.

The “fun” of a bill such as CISA is how vague they wind up being. It attempts to cast a huge net without much forethought of how that net can be abused. In the case of CISA, it can create less privacy. Researchers already do what they can to share vulnerabilities that they find, and still get ignore by the companies that have them. OPM hadn’t kept up on a basic security program, such as patching, multifactor authentication and auditing.

Wait, there is more. the FBI and White House are now complaining about encryption. you know the idea of securing communication and data so it is unreadable without the proper key? They want backdoors put into it. Now how is that going to help us? It doesn’t. In fact, I would guess that if a backdoor was put into encryption standards, it would take less than 48 hours for the hackers out there to find it and start exploiting it for their own ends.

Truth be told, politicians want to look like they are doing something about a variety of things without thinking of consequences. The authors of the Patriot Act have said over the years that it is not being used how they envisioned. We have laws on the table that criminalize behavior that is trivial (remember what Aaron Swartz was arrested for), and those laws give unproportional sentence guidelines. We have laws and reforms that have been presented that could make security researchers criminals. None of this really protects us. None of it makes logical sense. A criminal is not going to follow the law. Hackers in other countries are not subject to laws here in the U.S. Making research basically illegal at worst, or a gray area at best just opens up more holes for the criminals to use.

Unfortunately this is the case in this day and age. People don’t think things through. Politicians even more so, as they listen to lobbyists and staff members, without asking help from the real experts. We want a more secure society, and one that embraces privacy? We have to pressure our politicians from local to federal to listen to us and to think things through. Best intentions often go awry. they have to think of the worst use for the wording of laws they pass.

Thotcon 0x6 has come and gone

After a few years of swearing up and down, I finally made it to Thotcon. It was definitely an experience with good and bad.

Kinetic on Cybercrime

I found out about Thotcon a few years ago, but it always seemed to either conflict with my schedule, or I couldn’t get time off work for it. This year was different, so I bought myself a ticket and went. What I came into was an interesting mix of talks and socializing. Let’s start off though with the not so good aspects of it.

The whole idea of having to walk outside to get between tracks was one of the worst things about this convention, if only because you could not bring your booze outside. Yes the booze that you paid for, you had to chug or leave it behind when you went into the alley to get to the Turbo Talks in Track 2. Speaking f the Turbo Talks, I really felt that some of them that I saw, such as the one on the CFAA, and the one about Going Kinetic on Cyber-crime, should have been in Track 1 and some of the talks in Track 1 should have been limited down. I was disappointed in some of the Track 1 talks also, because they seemed to be more about trying to pimp the speaker, a “Hey, look at me, I am l33t,” and skipped around substance, or the speakers put in a lot of fluff to help stretch the time frame of the talk. Others probably will disagree with me, but I do know some other attendees felt the same way. Finally, the communication system inside the convention needed work. There were talks that were shifted between days or times near the last minute, which prevented people from seeing talks they had planned on. Day 2 they killed off the afternoon lunch break for Track 1an hour beforehand, moving all the talks up an hour. For myself this prevented me from seeing a talk in in Track 2 that I wanted to see because a talk in Track 1 was more important to me. Also, with no recordings of the talks, there was no way to catch up on missed ones.

While the venue itself was nice, the location was difficult. Being off the Brown Line meant the choices for public transportation were very limited, especially for those coming from the suburbs. This in itself stops some people from going to Thotcon, as the parking around the venue is difficult at best, and travel times there are tough to gauge.

Overall though, the convention was well organized. There was enough time between talks to not make one feel rushed, yet everything flowed. Registration on the first day was very smooth and problem free. Food in the venue was pretty good, and having a dedicated bar area upstairs of Track 1 and across the hall of Track 2 worked to keep noise down while the talks were going on. Also having video feeds in both bar areas was a nice way to allow people to keep track of what was going on. The awards presentations at the end of Day 2 went smooth and quick.

It was interesting to me that some of my favorite talks were non-technical in nature. The talks about the CFAA and how to get more active with the politicians were both amazing. The keynote by Jack Daniels was interesting, along with hearing the social engineering exploits of Jayson Street. The talk about taking down botnets and other cyber-crime operations was another favorite (pictured a the beginning of this article), as was the talk on the deep web. There were some talks I did walk out of, mostly because I found them either not what the abstract made them out to be, or just boring because they seemed to promote the speaker more than it being either a technical talk or call to arms talk.

Thotcon in general turned out to be a decent security (hacker) convention. Yes it has flaws, but the move to it being 2 days worked nicely. Don’t expect too much from it as far as deep technical talks (they decide dot not have workshops this year so they could have the main bar/socializing area), but instead figure you will get some tech, some policy and a nice overview of different topics. Definitely not a training convention as much as it is a call to arms for the infosec world convention.

Android Security: Google or Carriers issue?

In the world of Android a couple of disturbing articles have come out recently. Google is no long patching 4.3 (Jellybean) and earlier versions. Also the amount of malware for Android increased by 75% last year. This begs, who is to receive blame on the vendor side?

We all know people do not patch apps. Maybe they don’t like “new” terms that come with the update (most terms are the same as the prior versions). A lot get not the best information. Patching is important, and we all know that. In the world of PC’s we all know about Patch Tuesday (Microsoft, Adobe), and know how long it can take Apple to patch flaws in OSX and iOS (which they completely control and is out of the carriers hands). So what about Android, the worlds most popular phone OS?

The announcement this week that Google is no long patching WebView for versions 4.3 and earlier started me thinking more about this. Yes, Google is “abandoning” 930 Million users. Yes, They come out with new versions of Android so fast that the OS is fractured all over the place. The question is though, is Google doing the right thing? I personally think so. The reasoning why places a bunch of blame on the carriers.

Outside of iOS (iPhone), the carriers control when consumers get updates to their Android (and Windows) phones. In the world of Android, Google announces a patch, update, new version, then it gets sent to the device manufacturers. They have to test against their hardware and customization that they have done to Android for their devices (the look and feel of the OS you see). Then it gets sent to the carriers (Verizon, AT&T, Sprint, etc.) where even more testing has to be done against the carriers modifications to the OS (special built in apps, their radios, any network lock downs or features such as tracking cookies). Basically once Google releases the new version/patch/update getting it onto most peoples phones is out of their hands, the exception being the Nexus devices which Google controls. The longer an update take to get out there, the more chance there is for a breach. The easier it also may be for malware to get on the phones, and could be a reason the amount of malware for Android increased by 75% last year.

So the question arises, why does it take so long to hit our phones. the obvious and simple answer to me is money. Why bother pushing patches and updates, let alone new versions of the OS to phones especially ones that are only a year or two old, when you can try to force people to get new hardware, and either extend or get new contracts to get the latest? Security as a Service you can almost think of it as, but not quite. Seriously, the carriers have a cash cow on their hands with Android and doing things this way. The lastest verion of iOS is out and works on phones that are years old. Apple has it available for those older phones through their updater, although some features may not work on the older phones, it is still available. I am by no means an Apple fan, but the control they have over their updates is what Google needs to have over Android. The carriers don’t care, and won’t unless they lose some major lawsuit because someone’s phone got hacked due to a security update not having been available for that model. When I tweeted to my carrier (Verizon) about this, they sent me a link to their “news” page which has no information on updates. I also tweeted them back as they asked about what I was looking for (latest Windows Phone update, Android Lollipop) for specific devices. Never heard back from them.

The bottom line on this, from my perspective, is that both Google and the carriers are to blame. Google is to blame, not for not patching, but for not controlling the push out of patches and updates to the OS, and the carriers for not pushing out updates and patches in a timely fashion. Until this gets resolved, Android is going to stay heavily fragmented, and security for everyday peoples phones is going to be shaky at best.